A critical vulnerability, tracked as CVE-2026-118235, has been published for the SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress. According to the NVD record, all versions up to and including 3.10.2 allow unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The CVSS score is 9.8.
If your WordPress site uses this plugin, especially on a public page that embeds one of its forms, treat this as urgent. The sources reviewed do not name a fixed release, so part of this article covers what to do while that is unclear.
What happened
The vulnerability was published on October 31, 2026 by the National Vulnerability Database and mirrored the same day in the GitHub Advisory Database as GHSA-wjww-5gvr-r96j. A Wordfence Intelligence entry is also referenced. The weakness is classified as CWE-434, Unrestricted Upload of File with Dangerous Type.
The research does not report any confirmed exploitation in the wild, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing. That can change quickly for upload flaws that need no login, so absence of reports is not a reason to wait.
Technical details in plain terms
File upload features normally check the name and type of a file before saving it, so that a contact form accepts a PDF or an image but not a script. According to the advisory, the plugin's handle_upload function fails at this in two ways: it lacks a server-side allowlist of permitted file keys, and it works out the file extension before the filename is cleaned up. As a result, a filename ending in a trailing dot can slip past all of the extension and MIME checks.
If an uploaded file ends up somewhere the web server will execute it, an attacker can run their own code on the site. The advisory says the files may be executable and that remote code execution is possible. It does not say where files are stored or whether a typical server configuration would execute them, so the real-world impact on a given site depends on its setup.
Why the nonce does not help
The only access control on the upload is a WordPress nonce. The advisory notes that this nonce is printed into the data-nonce attribute of every public form, so any visitor who loads a page with the form shortcode can obtain it. A nonce is meant to guard against forged requests, not to act as a login, so here it provides no real barrier.
| Item | Detail |
|---|---|
| CVE | CVE-2026-118235 |
| Plugin | SimpleForm - Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications |
| Affected versions | All versions up to and including 3.10.2 |
| Fixed version | Not stated in the sources reviewed |
| CVSS | 9.8 critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Weakness | CWE-434, unrestricted upload of dangerous file type |
| Authentication | None required |
| Published | October 31, 2026 |
| Known exploitation | None reported in the research; not in CISA KEV |
Who is affected
Any WordPress site with the SimpleForm plugin installed at version 3.10.2 or earlier. Exposure is highest where a form from the plugin is embedded on a public page, because the advisory describes the nonce being available on any page that includes the form shortcode. A site with the plugin installed but no public form may be less exposed, though the sources do not confirm that, so do not rely on it.
Agencies and hosts that manage many WordPress sites should search their fleets for this plugin rather than relying on clients to report it.
How to check your exposure
- In the WordPress dashboard, open Plugins and look for SimpleForm. Note the installed version. From the command line, WP-CLI's plugin list command shows the same information.
- The plugin's directory slug appears to be simple-form, based on the references in the advisory. Check wp-content/plugins on the server if the dashboard is not available.
- Find pages that embed a form from the plugin. These are the pages where the nonce is exposed to visitors.
- Review the uploads directory and any folders the plugin writes to for files you do not recognize, particularly script files such as .php or files with unusual or trailing-dot names.
- Check web server access logs for unexpected POST requests to admin-ajax.php from unfamiliar addresses, followed by requests for newly created files. Treat this as a hint to investigate, not proof either way.
You can also look up the plugin on our WordPress plugin vulnerability pages and read the guide on checking whether a plugin is vulnerable.
What to do now
The sources reviewed do not state a patched version. The advisory references a change to FileUpload.php in the plugin's trunk, which may be the fix, but the research does not confirm that or tie it to a released version. Check the plugin's page in the WordPress dashboard or the official plugin directory for an update newer than 3.10.2 and read its changelog before relying on it.
- Back up the site and database first, so you can roll back and have evidence if you later find a compromise.
- If an update newer than 3.10.2 is available and its changelog mentions the upload issue, install it.
- If no fixed release is available, deactivate and remove the plugin, or at least remove it from public pages until a fix is confirmed. Deactivating the plugin stops its upload handler from loading.
- Look for signs of compromise as described above. If you find unexpected executable files, follow our guide on what to do if your website is hacked, including rotating WordPress, database, hosting and API credentials.
- Harden uploads in general: configure the web server so that scripts cannot execute from the uploads directory, and keep file permissions as restrictive as the site allows.
Detection and ongoing monitoring
Upload bugs of this type are often followed by webshells that sit quietly until used. After you have dealt with the plugin, keep watching for changes: new files in writable directories, new administrator accounts, modified core or theme files, and unexpected outbound traffic from the server.
A website firewall can add a layer of filtering in front of form endpoints, but it should not be your only response, and rules do not exist for every flaw on day one. For a broader routine, see the WordPress security checklist. A free outside-in check with the malware scanner can help spot visible signs of compromise, though it cannot see files that are hidden on the server.
What is still unknown
- The first patched version is not stated in the sources reviewed.
- Whether the vulnerability is being exploited in the wild is not reported.
- The sources do not describe where uploaded files are stored or how many sites run the plugin.
- The GitHub advisory is marked unreviewed and lists affected and patched versions as unknown. The 3.10.2 boundary comes from the NVD and advisory description text.
We will treat these points as open until the plugin author or the vulnerability databases publish more detail.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.
- CVE-2026-118235 - GitHub Advisory Database (github.com)
- CVE-2026-118235: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all… (nvd.nist.gov, )
Tags: WordPress, plugin vulnerability, file upload, RCE, CVE-2026-118235